Support

Have you enabled the IP blacklist feature in the WAF Configure page? If you haven't, anything you put in the blacklist is silently ignored.

That said, login failures will always be logged, even for blacklisted addresses. This has to do with the order of operations in Joomla. Roughly speaking, at some point Joomla loads the system plugins including Admin Tools' system plugin. Then it processes login information. And only after that will it run the first event available to system plugins, onAfterInitialize. Admin Tools processes the IP blacklist inside onAfterInitialize. If a failed login attempt occurs before Joomla calls that code you get a login error logged. However, even if the attacker managed to guess the correct username and password Admin Tools' blacklist feature would STILL block them. Even better, the attacker would NOT know that Joomla accepted their username and password because from their point of view they receive no login cookie and no feedback other than Admin Tools blocking them. Therefore you can ignore those entries. There are several dozens of tickets where I have explained that.

Regarding 127.0.0.1, this seems to be a script running on your server screwing up (or a different hacked site on the same server trying to access your site). You can't do much about it. You can always try to block 127.0.0.1 but this means that any CRON jobs you've set up and which try to access your site over HTTP/HTTPS will fail.